|
|
Malware Tests - removal of the newest malware.
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Get it! |
 %windir%\dll\rundll32.exe - Dangerous
%WinDir%\DLL\RUNDLL32.exe is Trojan/Backdoor. Kill the process %WinDir%\DLL\RUNDLL32.exe and remove %WinDir%\DLL\RUNDLL32.exe from Windows startup. File: C:\sand-box\winrar.exe Classification: Antivirus Version Last Update Result Avast 4.8.1335.0 2009.06.15 Win32:Trojan-gen {Other} AVG 8.5.0.339 2009.06.15 Clicker.ZOC BitDefender 7.2 2009.06.16 - DrWeb 5.0.0.12182 2009.06.16 BackDoor.BlackHole.3413 F-Secure 8.0.14470.0 2009.06.15 Trojan.Win32.Delf.nia NOD32 4157 2009.06.15 probably a variant of Win32/TrojanClicker.Delf.NHN Panda 10.0.0.14 2009.06.15 Trj/Clicker.AOV Symantec 1.4.4.12 2009.06.16 Trojan.Adclicker Additional information File size: 235520 bytes MD5 : e0d9f6d426c40eb7c539dc46d7d230b9 SHA1 : 95518314fe9023f0cd2e4bda019d7541391a8438 Installation When the program is executed, it creates the following registry subkeys and values: ---------------------------------- Keys added:4 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCPSRV HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCPSRV\0000 HKLM\SYSTEM\CurrentControlSet\Services\DhcpSrv HKLM\SYSTEM\CurrentControlSet\Services\DhcpSrv\Security ---------------------------------- Values added:14 ---------------------------------- HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCPSRV\0000\Service: "DhcpSrv" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCPSRV\0000\Legacy: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCPSRV\0000\ConfigFlags: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCPSRV\0000\Class: "LegacyDriver" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCPSRV\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCPSRV\0000\DeviceDesc: "Dhcp server" HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCPSRV\NextInstance: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\DhcpSrv\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 HKLM\SYSTEM\CurrentControlSet\Services\DhcpSrv\Type: 0x00000110 HKLM\SYSTEM\CurrentControlSet\Services\DhcpSrv\Start: 0x00000002 HKLM\SYSTEM\CurrentControlSet\Services\DhcpSrv\ErrorControl: 0x00000001 HKLM\SYSTEM\CurrentControlSet\Services\DhcpSrv\ImagePath: "C:\WINDOWS\DLL\RUNDLL32.exe" HKLM\SYSTEM\CurrentControlSet\Services\DhcpSrv\DisplayName: "Dhcp server" HKLM\SYSTEM\CurrentControlSet\Services\DhcpSrv\ObjectName: "LocalSystem" ---------------------------------- Values modified:0 ---------------------------------- ---------------------------------- Files added:9 ---------------------------------- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\3PCMMHXU\ErrorPageTemplate[1] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\3PCMMHXU\info_48[1] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\6IMCJ0DW\bullet[1] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\6IMCJ0DW\errorPageStrings[1] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LUIIOHEM\background_gradient[1] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LUIIOHEM\dnserrordiagoff_webOC[1] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\VNEWMRCS\down[1] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\VNEWMRCS\httpErrorPagesScripts[1] C:\WINDOWS\DLL\RUNDLL32.exe ---------------------------------- Files deleted:1 ---------------------------------- C:\sand-box\winrar.exe ---------------------------------- Files [attributes?] modified:0 ---------------------------------- ---------------------------------- Folders added:1 ---------------------------------- C:\WINDOWS\DLL ---------------------------------- Folders deleted:0 ---------------------------------- ---------------------------------- Total changes:29 ---------------------------------- ------------------------------------------------------------------------------------- Detected by RegRun Reanimator: Type: Auto Services Item Name: DhcpSrv Related File: C:\WINDOWS\DLL\RUNDLL32.exe Type: Running Processes Item Name: RUNDLL32.exe Related File: C:\WINDOWS\DLL\RUNDLL32.exe Removal Results: Success Number of reboot: 1 Removal: %windir%\dll\rundll32.exe is removed by RegRun.
Click on the "Get it out!" button.  We suggest you to reboot your computer to be sure that your computer is clean now. Do not hesitate to contact us: Support center
UnHackMe - Rootkit/Malware killer
Also recommended software: UnHackMe is a part of RegRun Security Suite Platinum.
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: November 16 2009
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
Download RegRun Suite. 
Open an executable file to start program installation.
